Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/profile_permissions.go

@@ -29,8 +29,9 @@ func (h *ProfilePermissionsHandler) GetMyPermissions(c *gin.Context) {
 	// Admin gets all permissions by definition.
 	var list []string
 	if role == "admin" {
-		list = make([]string, len(auth.AllPermissions))
-		copy(list, auth.AllPermissions)
+		all := auth.AllPermissionsWithExtensions()
+		list = make([]string, len(all))
+		copy(list, all)
 	} else {
 		perms, err := auth.ResolvePermissions(ctx, h.stores, userID)
 		if err != nil {